by blueranger » October 28th, 2006, 1:15 pm
Kim
First log:
REGEDIT4
; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.1.0
; Results at 28/10/2006 18:14:15 for strings:
; 'isponer'
; 'rundll.exe'
; Strings excluded from search:
; (None)
; Search in:
; Registry Keys Registry Values Registry Data
; HKEY_LOCAL_MACHINE HKEY_USERS
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation]
"KillList"="%1;explorer.exe;dvdplay.exe;mplay32.exe;msohtmed.exe;quikview.exe;rundll.exe;rundll32.exe;taskman.exe;bck32api.dll;"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\Application]
; Contents of value:
; WSH
; WMIAdapter Wmdm
; WmdmPmSN WinMgmt Winlogo
; WinMgmt Winlogon Windows Product
; Winlogon Windows Product Activation Windo
; Windows Product Activation Windows 3.1 Migration WebClient VSS VBRun
; Windows 3.1 Migration WebClient VSS VBRuntime Userinit Userenv UploadM SysmonLog SpoolerCt
; WebClient VSS VBRuntime Userinit Userenv UploadM SysmonLog SpoolerCtrs Software Installation SclgNtf
; VSS VBRuntime Userinit Userenv UploadM SysmonLog SpoolerCtrs Software Installation SclgNtfy SceSrv SceCl
; VBRuntime Userinit Userenv UploadM SysmonLog SpoolerCtrs Software Installation SclgNtfy SceSrv SceCli safrslv SAFr
; Userinit Userenv UploadM SysmonLog SpoolerCtrs Software Installation SclgNtfy SceSrv SceCli safrslv SAFrdms PerfProc PerfOS
; Userenv UploadM SysmonLog SpoolerCtrs Software Installation SclgNtfy SceSrv SceCli safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon
; UploadM SysmonLog SpoolerCtrs Software Installation SclgNtfy SceSrv SceCli safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk
; SysmonLog SpoolerCtrs Software Installation SclgNtfy SceSrv SceCli safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook
; SpoolerCtrs Software Installation SclgNtfy SceSrv SceCli safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley n
; Software Installation SclgNtfy SceSrv SceCli safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC
; SclgNtfy SceSrv SceCli safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Mi
; SceSrv SceCli safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 1
; SceCli safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Jav
; safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER He
; SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Red
; PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Dep
; PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSys
; PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL
; Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQu
; Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+
; PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms
; Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Al
; Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrol
; Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Applicat
; Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Applic
; ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Appli
; MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error app
; MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; Autochk Application Management Application Hang Application Error apphelp Application
; Application Management Application Hang Application Error apphelp Application
; Application Hang Application Error apphelp Application
; Application Error apphelp Application
; apphelp Application
; Application
;
"Sources"=hex(7):57,53,48,00,57,4d,49,41,64,61,70,74,65,72,00,57,6d,64,6d,50,\
6d,53,4e,00,57,69,6e,4d,67,6d,74,00,57,69,6e,6c,6f,67,6f,6e,00,57,69,6e,64,\
6f,77,73,20,50,72,6f,64,75,63,74,20,41,63,74,69,76,61,74,69,6f,6e,00,57,69,\
6e,64,6f,77,73,20,33,2e,31,20,4d,69,67,72,61,74,69,6f,6e,00,57,65,62,43,6c,\
69,65,6e,74,00,56,53,53,00,56,42,52,75,6e,74,69,6d,65,00,55,73,65,72,69,6e,\
69,74,00,55,73,65,72,65,6e,76,00,55,70,6c,6f,61,64,4d,00,53,79,73,6d,6f,6e,\
4c,6f,67,00,53,70,6f,6f,6c,65,72,43,74,72,73,00,53,6f,66,74,77,61,72,65,20,\
49,6e,73,74,61,6c,6c,61,74,69,6f,6e,00,53,63,6c,67,4e,74,66,79,00,53,63,65,\
53,72,76,00,53,63,65,43,6c,69,00,73,61,66,72,73,6c,76,00,53,41,46,72,64,6d,\
73,00,50,65,72,66,50,72,6f,63,00,50,65,72,66,4f,53,00,50,65,72,66,4e,65,74,\
00,50,65,72,66,6d,6f,6e,00,50,65,72,66,6c,69,62,00,50,65,72,66,44,69,73,6b,\
00,50,65,72,66,63,74,72,73,00,4f,75,74,6c,6f,6f,6b,00,4f,66,66,6c,69,6e,65,\
20,46,69,6c,65,73,00,4f,61,6b,6c,65,79,00,6e,74,62,61,63,6b,75,70,00,4d,53,\
53,4f,41,50,00,4d,73,69,49,6e,73,74,61,6c,6c,65,72,00,4d,53,44,54,43,20,43,\
6c,69,65,6e,74,00,4d,53,44,54,43,00,4d,53,44,4d,69,6e,65,00,6d,6e,6d,73,72,\
76,63,00,4d,69,63,72,6f,73,6f,66,74,20,4f,66,66,69,63,65,20,31,31,00,4c,6f,\
61,64,50,65,72,66,00,4a,61,76,61,20,56,4d,00,69,53,50,4f,4e,45,52,00,48,65,\
6c,70,53,76,63,00,46,6f,6c,64,65,72,20,52,65,64,69,72,65,63,74,69,6f,6e,00,\
46,69,6c,65,20,44,65,70,6c,6f,79,6d,65,6e,74,00,45,76,65,6e,74,53,79,73,74,\
65,6d,00,45,53,45,4e,54,00,45,41,50,4f,4c,00,44,72,57,61,74,73,6f,6e,00,44,\
69,73,6b,51,75,6f,74,61,00,63,72,79,70,74,33,32,00,43,4f,4d,2b,00,43,69,00,\
43,68,6b,64,73,6b,00,41,76,67,45,6d,73,00,41,76,67,37,55,70,64,53,76,63,00,\
41,76,67,37,41,6c,72,74,00,41,56,47,37,00,41,75,74,6f,45,6e,72,6f,6c,6c,6d,\
65,6e,74,00,41,75,74,6f,63,68,6b,00,41,70,70,6c,69,63,61,74,69,6f,6e,20,4d,\
61,6e,61,67,65,6d,65,6e,74,00,41,70,70,6c,69,63,61,74,69,6f,6e,20,48,61,6e,\
67,00,41,70,70,6c,69,63,61,74,69,6f,6e,20,45,72,72,6f,72,00,61,70,70,68,65,\
6c,70,00,41,70,70,6c,69,63,61,74,69,6f,6e,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\Application\iSPONER]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\Application\iSPONER]
; Contents of value:
; c:\windows\system32\rundll.exe c:\windows\system32\wbem\kjrtml61.dll,export 1087
"EventMessageFile"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,53,59,53,54,45,4d,\
33,32,5c,52,55,4e,44,4c,4c,2e,45,58,45,20,43,3a,5c,57,49,4e,44,4f,57,53,5c,\
53,59,53,54,45,4d,33,32,5c,57,42,45,4d,5c,4b,4a,52,54,4d,4c,36,31,2e,44,4c,\
4c,2c,45,78,70,6f,72,74,20,31,30,38,37,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application]
; Contents of value:
; Microsoft H.323 Telephony Service Provider
; WSH WMIAdapter WmdmPmSN WinMgmt Winlogon Window
; WMIAdapter WmdmPmSN WinMgmt Winlogon Windows Product Activ
; WmdmPmSN WinMgmt Winlogon Windows Product Activation Windows 3.1 Mi
; WinMgmt Winlogon Windows Product Activation Windows 3.1 Migration WebClient
; Winlogon Windows Product Activation Windows 3.1 Migration WebClient VSS VBRuntime Us
; Windows Product Activation Windows 3.1 Migration WebClient VSS VBRuntime Userinit Userenv UploadM SysmonLog Spo
; Windows 3.1 Migration WebClient VSS VBRuntime Userinit Userenv UploadM SysmonLog SpoolerCtrs Software Installation SclgNtfy SceSrv Sc
; WebClient VSS VBRuntime Userinit Userenv UploadM SysmonLog SpoolerCtrs Software Installation SclgNtfy SceSrv SceCli safrslv SAFrdms PerfProc Pe
; VSS VBRuntime Userinit Userenv UploadM SysmonLog SpoolerCtrs Software Installation SclgNtfy SceSrv SceCli safrslv SAFrdms PerfProc PerfOS PerfNet P
; VBRuntime Userinit Userenv UploadM SysmonLog SpoolerCtrs Software Installation SclgNtfy SceSrv SceCli safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib
; Userinit Userenv UploadM SysmonLog SpoolerCtrs Software Installation SclgNtfy SceSrv SceCli safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs
; Userenv UploadM SysmonLog SpoolerCtrs Software Installation SclgNtfy SceSrv SceCli safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline F
; UploadM SysmonLog SpoolerCtrs Software Installation SclgNtfy SceSrv SceCli safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntba
; SysmonLog SpoolerCtrs Software Installation SclgNtfy SceSrv SceCli safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiIns
; SpoolerCtrs Software Installation SclgNtfy SceSrv SceCli safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MS
; Software Installation SclgNtfy SceSrv SceCli safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Offi
; SclgNtfy SceSrv SceCli safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER
; SceSrv SceCli safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder R
; SceCli safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection Fil
; safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment Ev
; SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT
; PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson Di
; PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32
; PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk
; Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSv
; Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7
; PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Au
; Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application
; Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Applic
; Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application
; Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Applic
; ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; Autochk Application Management Application Hang Application Error apphelp Application
; Application Management Application Hang Application Error apphelp Application
; Application Hang Application Error apphelp Application
; Application Error apphelp Application
; apphelp Application
; Application
;
"Sources"=hex(7):4d,69,63,72,6f,73,6f,66,74,20,48,2e,33,32,33,20,54,65,6c,65,\
70,68,6f,6e,79,20,53,65,72,76,69,63,65,20,50,72,6f,76,69,64,65,72,00,57,53,\
48,00,57,4d,49,41,64,61,70,74,65,72,00,57,6d,64,6d,50,6d,53,4e,00,57,69,6e,\
4d,67,6d,74,00,57,69,6e,6c,6f,67,6f,6e,00,57,69,6e,64,6f,77,73,20,50,72,6f,\
64,75,63,74,20,41,63,74,69,76,61,74,69,6f,6e,00,57,69,6e,64,6f,77,73,20,33,\
2e,31,20,4d,69,67,72,61,74,69,6f,6e,00,57,65,62,43,6c,69,65,6e,74,00,56,53,\
53,00,56,42,52,75,6e,74,69,6d,65,00,55,73,65,72,69,6e,69,74,00,55,73,65,72,\
65,6e,76,00,55,70,6c,6f,61,64,4d,00,53,79,73,6d,6f,6e,4c,6f,67,00,53,70,6f,\
6f,6c,65,72,43,74,72,73,00,53,6f,66,74,77,61,72,65,20,49,6e,73,74,61,6c,6c,\
61,74,69,6f,6e,00,53,63,6c,67,4e,74,66,79,00,53,63,65,53,72,76,00,53,63,65,\
43,6c,69,00,73,61,66,72,73,6c,76,00,53,41,46,72,64,6d,73,00,50,65,72,66,50,\
72,6f,63,00,50,65,72,66,4f,53,00,50,65,72,66,4e,65,74,00,50,65,72,66,6d,6f,\
6e,00,50,65,72,66,6c,69,62,00,50,65,72,66,44,69,73,6b,00,50,65,72,66,63,74,\
72,73,00,4f,75,74,6c,6f,6f,6b,00,4f,66,66,6c,69,6e,65,20,46,69,6c,65,73,00,\
4f,61,6b,6c,65,79,00,6e,74,62,61,63,6b,75,70,00,4d,53,53,4f,41,50,00,4d,73,\
69,49,6e,73,74,61,6c,6c,65,72,00,4d,53,44,54,43,20,43,6c,69,65,6e,74,00,4d,\
53,44,54,43,00,4d,53,44,4d,69,6e,65,00,6d,6e,6d,73,72,76,63,00,4d,69,63,72,\
6f,73,6f,66,74,20,4f,66,66,69,63,65,20,31,31,00,4c,6f,61,64,50,65,72,66,00,\
4a,61,76,61,20,56,4d,00,69,53,50,4f,4e,45,52,00,48,65,6c,70,53,76,63,00,46,\
6f,6c,64,65,72,20,52,65,64,69,72,65,63,74,69,6f,6e,00,46,69,6c,65,20,44,65,\
70,6c,6f,79,6d,65,6e,74,00,45,76,65,6e,74,53,79,73,74,65,6d,00,45,53,45,4e,\
54,00,45,41,50,4f,4c,00,44,72,57,61,74,73,6f,6e,00,44,69,73,6b,51,75,6f,74,\
61,00,63,72,79,70,74,33,32,00,43,4f,4d,2b,00,43,69,00,43,68,6b,64,73,6b,00,\
41,76,67,45,6d,73,00,41,76,67,37,55,70,64,53,76,63,00,41,76,67,37,41,6c,72,\
74,00,41,56,47,37,00,41,75,74,6f,45,6e,72,6f,6c,6c,6d,65,6e,74,00,41,75,74,\
6f,63,68,6b,00,41,70,70,6c,69,63,61,74,69,6f,6e,20,4d,61,6e,61,67,65,6d,65,\
6e,74,00,41,70,70,6c,69,63,61,74,69,6f,6e,20,48,61,6e,67,00,41,70,70,6c,69,\
63,61,74,69,6f,6e,20,45,72,72,6f,72,00,61,70,70,68,65,6c,70,00,41,70,70,6c,\
69,63,61,74,69,6f,6e,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application\iSPONER]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application\iSPONER]
; Contents of value:
; c:\windows\system32\rundll.exe c:\windows\system32\wbem\kjrtml61.dll,export 1087
"EventMessageFile"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,53,59,53,54,45,4d,\
33,32,5c,52,55,4e,44,4c,4c,2e,45,58,45,20,43,3a,5c,57,49,4e,44,4f,57,53,5c,\
53,59,53,54,45,4d,33,32,5c,57,42,45,4d,5c,4b,4a,52,54,4d,4c,36,31,2e,44,4c,\
4c,2c,45,78,70,6f,72,74,20,31,30,38,37,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application]
; Contents of value:
; Microsoft H.323 Telephony Service Provider
; WSH WMIAdapter WmdmPmSN WinMgmt Winlogon Window
; WMIAdapter WmdmPmSN WinMgmt Winlogon Windows Product Activ
; WmdmPmSN WinMgmt Winlogon Windows Product Activation Windows 3.1 Mi
; WinMgmt Winlogon Windows Product Activation Windows 3.1 Migration WebClient
; Winlogon Windows Product Activation Windows 3.1 Migration WebClient VSS VBRuntime Us
; Windows Product Activation Windows 3.1 Migration WebClient VSS VBRuntime Userinit Userenv UploadM SysmonLog Spo
; Windows 3.1 Migration WebClient VSS VBRuntime Userinit Userenv UploadM SysmonLog SpoolerCtrs Software Installation SclgNtfy SceSrv Sc
; WebClient VSS VBRuntime Userinit Userenv UploadM SysmonLog SpoolerCtrs Software Installation SclgNtfy SceSrv SceCli safrslv SAFrdms PerfProc Pe
; VSS VBRuntime Userinit Userenv UploadM SysmonLog SpoolerCtrs Software Installation SclgNtfy SceSrv SceCli safrslv SAFrdms PerfProc PerfOS PerfNet P
; VBRuntime Userinit Userenv UploadM SysmonLog SpoolerCtrs Software Installation SclgNtfy SceSrv SceCli safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib
; Userinit Userenv UploadM SysmonLog SpoolerCtrs Software Installation SclgNtfy SceSrv SceCli safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs
; Userenv UploadM SysmonLog SpoolerCtrs Software Installation SclgNtfy SceSrv SceCli safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline F
; UploadM SysmonLog SpoolerCtrs Software Installation SclgNtfy SceSrv SceCli safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntba
; SysmonLog SpoolerCtrs Software Installation SclgNtfy SceSrv SceCli safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiIns
; SpoolerCtrs Software Installation SclgNtfy SceSrv SceCli safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MS
; Software Installation SclgNtfy SceSrv SceCli safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Offi
; SclgNtfy SceSrv SceCli safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER
; SceSrv SceCli safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder R
; SceCli safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection Fil
; safrslv SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment Ev
; SAFrdms PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT
; PerfProc PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson Di
; PerfOS PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32
; PerfNet Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk
; Perfmon Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSv
; Perflib PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7
; PerfDisk Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Au
; Perfctrs Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application
; Outlook Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Applic
; Offline Files Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application
; Oakley ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Applic
; ntbackup MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; MSSOAP MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; MsiInstaller MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; MSDTC Client MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; MSDTC MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; MSDMine mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; mnmsrvc Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; Microsoft Office 11 LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; LoadPerf Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; Java VM iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; iSPONER HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; HelpSvc Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; Folder Redirection File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; File Deployment EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; EventSystem ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; ESENT EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; EAPOL DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; DrWatson DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; DiskQuota crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; crypt32 COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; COM+ Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; Ci Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; Chkdsk AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; AvgEms Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; Avg7UpdSvc Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; Avg7Alrt AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; AVG7 AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; AutoEnrollment Autochk Application Management Application Hang Application Error apphelp Application
; Autochk Application Management Application Hang Application Error apphelp Application
; Application Management Application Hang Application Error apphelp Application
; Application Hang Application Error apphelp Application
; Application Error apphelp Application
; apphelp Application
; Application
;
"Sources"=hex(7):4d,69,63,72,6f,73,6f,66,74,20,48,2e,33,32,33,20,54,65,6c,65,\
70,68,6f,6e,79,20,53,65,72,76,69,63,65,20,50,72,6f,76,69,64,65,72,00,57,53,\
48,00,57,4d,49,41,64,61,70,74,65,72,00,57,6d,64,6d,50,6d,53,4e,00,57,69,6e,\
4d,67,6d,74,00,57,69,6e,6c,6f,67,6f,6e,00,57,69,6e,64,6f,77,73,20,50,72,6f,\
64,75,63,74,20,41,63,74,69,76,61,74,69,6f,6e,00,57,69,6e,64,6f,77,73,20,33,\
2e,31,20,4d,69,67,72,61,74,69,6f,6e,00,57,65,62,43,6c,69,65,6e,74,00,56,53,\
53,00,56,42,52,75,6e,74,69,6d,65,00,55,73,65,72,69,6e,69,74,00,55,73,65,72,\
65,6e,76,00,55,70,6c,6f,61,64,4d,00,53,79,73,6d,6f,6e,4c,6f,67,00,53,70,6f,\
6f,6c,65,72,43,74,72,73,00,53,6f,66,74,77,61,72,65,20,49,6e,73,74,61,6c,6c,\
61,74,69,6f,6e,00,53,63,6c,67,4e,74,66,79,00,53,63,65,53,72,76,00,53,63,65,\
43,6c,69,00,73,61,66,72,73,6c,76,00,53,41,46,72,64,6d,73,00,50,65,72,66,50,\
72,6f,63,00,50,65,72,66,4f,53,00,50,65,72,66,4e,65,74,00,50,65,72,66,6d,6f,\
6e,00,50,65,72,66,6c,69,62,00,50,65,72,66,44,69,73,6b,00,50,65,72,66,63,74,\
72,73,00,4f,75,74,6c,6f,6f,6b,00,4f,66,66,6c,69,6e,65,20,46,69,6c,65,73,00,\
4f,61,6b,6c,65,79,00,6e,74,62,61,63,6b,75,70,00,4d,53,53,4f,41,50,00,4d,73,\
69,49,6e,73,74,61,6c,6c,65,72,00,4d,53,44,54,43,20,43,6c,69,65,6e,74,00,4d,\
53,44,54,43,00,4d,53,44,4d,69,6e,65,00,6d,6e,6d,73,72,76,63,00,4d,69,63,72,\
6f,73,6f,66,74,20,4f,66,66,69,63,65,20,31,31,00,4c,6f,61,64,50,65,72,66,00,\
4a,61,76,61,20,56,4d,00,69,53,50,4f,4e,45,52,00,48,65,6c,70,53,76,63,00,46,\
6f,6c,64,65,72,20,52,65,64,69,72,65,63,74,69,6f,6e,00,46,69,6c,65,20,44,65,\
70,6c,6f,79,6d,65,6e,74,00,45,76,65,6e,74,53,79,73,74,65,6d,00,45,53,45,4e,\
54,00,45,41,50,4f,4c,00,44,72,57,61,74,73,6f,6e,00,44,69,73,6b,51,75,6f,74,\
61,00,63,72,79,70,74,33,32,00,43,4f,4d,2b,00,43,69,00,43,68,6b,64,73,6b,00,\
41,76,67,45,6d,73,00,41,76,67,37,55,70,64,53,76,63,00,41,76,67,37,41,6c,72,\
74,00,41,56,47,37,00,41,75,74,6f,45,6e,72,6f,6c,6c,6d,65,6e,74,00,41,75,74,\
6f,63,68,6b,00,41,70,70,6c,69,63,61,74,69,6f,6e,20,4d,61,6e,61,67,65,6d,65,\
6e,74,00,41,70,70,6c,69,63,61,74,69,6f,6e,20,48,61,6e,67,00,41,70,70,6c,69,\
63,61,74,69,6f,6e,20,45,72,72,6f,72,00,61,70,70,68,65,6c,70,00,41,70,70,6c,\
69,63,61,74,69,6f,6e,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\iSPONER]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\iSPONER]
; Contents of value:
; c:\windows\system32\rundll.exe c:\windows\system32\wbem\kjrtml61.dll,export 1087
"EventMessageFile"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,53,59,53,54,45,4d,\
33,32,5c,52,55,4e,44,4c,4c,2e,45,58,45,20,43,3a,5c,57,49,4e,44,4f,57,53,5c,\
53,59,53,54,45,4d,33,32,5c,57,42,45,4d,5c,4b,4a,52,54,4d,4c,36,31,2e,44,4c,\
4c,2c,45,78,70,6f,72,74,20,31,30,38,37,00
; End Of The Log...